From: Arjun Shankar <arjun.is@lostca.se>
To: libc-stable@sourceware.org
Subject: [COMMITTED 2.28] malloc: Add more integrity checks to mremap_chunk.
Date: Tue, 01 Jan 2019 00:00:00 -0000 [thread overview]
Message-ID: <20190502124218.GB16742@aloka.lostca.se> (raw)
* malloc/malloc.c (mremap_chunk): Additional checks.
(cherry picked from commit ebe544bf6e8eec35e754fd49efb027c6f161b6cb)
---
ChangeLog | 4 ++++
malloc/malloc.c | 12 +++++++++---
2 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index c42b55f72f..e2d7e3caca 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2018-12-20 Istvan Kurucsai <pistukem@gmail.com>
+
+ * malloc/malloc.c (mremap_chunk): Additional checks.
+
2018-08-17 Istvan Kurucsai <pistukem@gmail.com>
* malloc/malloc.c (_int_malloc): Additional binning code checks.
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 520a4faa7c..7880fcd1c3 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2849,16 +2849,22 @@ mremap_chunk (mchunkptr p, size_t new_size)
char *cp;
assert (chunk_is_mmapped (p));
- assert (((size + offset) & (GLRO (dl_pagesize) - 1)) == 0);
+
+ uintptr_t block = (uintptr_t) p - offset;
+ uintptr_t mem = (uintptr_t) chunk2mem(p);
+ size_t total_size = offset + size;
+ if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
+ || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
+ malloc_printerr("mremap_chunk(): invalid pointer");
/* Note the extra SIZE_SZ overhead as in mmap_chunk(). */
new_size = ALIGN_UP (new_size + offset + SIZE_SZ, pagesize);
/* No need to remap if the number of pages does not change. */
- if (size + offset == new_size)
+ if (total_size == new_size)
return p;
- cp = (char *) __mremap ((char *) p - offset, size + offset, new_size,
+ cp = (char *) __mremap ((char *) block, total_size, new_size,
MREMAP_MAYMOVE);
if (cp == MAP_FAILED)
--
2.20.1
reply other threads:[~2019-05-02 12:42 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190502124218.GB16742@aloka.lostca.se \
--to=arjun.is@lostca.se \
--cc=libc-stable@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).